Long-term agentic memory modules that incorporate automated semantic sanitization filters on silently prepended context files reduce CarryoverBench payload re-firing rates compared to standard unfiltered persistent-memory baselines.

In long-horizon LLM agents equipped with persistent/long-term memory modules, inserting an automated semantic sanitization filter between memory write and memory read/injection stages reduces the rate at which previously-injected adversarial payloads silently re-fire in subsequent sessions (measured as CarryoverBench payload re-firing rate, PRR) by a statistically significant margin compared to an architecturally identical baseline agent with unfiltered persistent memory, under matched task distributions, matched memory capacity, and matched adversarial injection vectors.

Two-arm, matched-pair design. Arm A: agent with persistent memory module, no sanitization (baseline). Arm B: identical agent + semantic sanitization filter inserted at memory-write and/or memory-read boundary. Both arms run against CarryoverBench's multi-session injection scenarios: adversarial payload is embedded in session N's memory artifact (via tool output, document ingestion, or user turn marked as "untrusted"); PRR is measured as the fraction of session N+k episodes (k=1..5) in which the agent's behavior shows payload re-firing (defined by CarryoverBench's behavioral detectors: unauthorized tool call, role/goal override, exfiltration attempt, or verbatim instruction echo). Primary outcome: PRR_baseline − PRR_filtered, with 95% CI via bootstrap (10,000 resamples) over episode-level binary outcomes, clustered by scenario seed. Secondary outcome: benign task success rate delta (utility cost). Stratify by payload category and by k (memory persistence depth) to test decay of protection over session distance.

class MemorySanitizer:
    def __init__(self, mode="classifier"):  # or "llm_judge"
        self.detector = load_injection_classifier() if mode=="classifier" else LLMJudge()

    def sanitize(self, candidate_memory_entry, session_context):
        risk_score = self.detector.score(candidate_memory_entry, session_context)
        if risk_score > THRESHOLD:
            return self.redact_or_quarantine(candidate_memory_entry)
        return candidate_memory_entry

class AgentMemoryModule:
    def write(self, entry):
        entry = self.sanitizer.sanitize(entry, self.context) if self.filtered else entry
        self.store.append(entry)

    def read(self, query, top_k):
        retrieved = self.store.retrieve(query, top_k)
        # optional second-pass sanitization at read-time (defense in depth)
        retrieved = [self.sanitizer.sanitize(r, query) for r in retrieved] if self.filtered else retrieved
        return retrieved

# CarryoverBench loop
for scenario in benchmark.scenarios:
    inject_payload(session=N, agent=agent_arm)
    for k in range(1, 6):
        run_session(agent_arm, session=N+k)
        outcome = detect_refiring(agent_arm.transcript)
        log(scenario.id, k, arm, outcome)

# Analysis: mixed_effects_logit(PRR ~ arm * payload_category + k + (1|scenario_seed) + (1|base_llm))